118a98d85cccdf5ca8c02a933fe2f71bd75d8e55290c58422b203234d0421f72

Analysis

max time kernel
27s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
24/06/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
118a98d85cccdf5ca8c02a933fe2f71bd75d8e55290c58422b203234d0421f72.apk
Size 2.5MB
Sample240624-wpdrxaydpp
SHA256 118a98d85cccdf5ca8c02a933fe2f71bd75d8e55290c58422b203234d0421f72
MD5 34c394897b6c0fee1be077cfa061ec50
SHA1 20971ffe9f0356ce75b66372df054766dd56e979
SHA512 b238fa8f5a6562e29f2b450e99881983d707859071babe7f1d365e12e038f3dcb23cf910f6e01a42a2fdc9cb357c317a931d90e8222bd54da97a38020b70fa18
SSDEEP 49152:wQw+xns3WIlFHyJVQ2QbpzcqvganpqMIoTwrswYF83:wd+BsPHbvOiwoTwrswYS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.god.salvation
/system/bin/su	com.god.salvation

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.god.salvation

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.god.salvation

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.god.salvation

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.god.salvation

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.god.salvation

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.god.salvation

com.god.salvation
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4433

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.god.salvation/databases/com.google.android.datatransport.events
Size 56KB
SHA256 121a2e01aa855d345ad8c5b8ec50032e51a5aad07d139b0c1f47309db90b89b9
MD5 1e00955c9ca38695ec57d07330b46e04
SHA1 4664fe954d0318563b51c6f87a82aa76c6996cfc
SHA512 cdcd4c1cc8f21252797dee974c4f546109ae4bc784c0ba77db29571a660b7b5ad312c162bc9403fb6e2efab9bfdf02f2e0422ee4a95469272d39545b546a49aa
SSDEEP 48:T/3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPS0:rAMEX0wIyNja0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.god.salvation/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 d1a2e3d5ce698e40582fe48e2348d1e7047bdbebecd3a4796ac80239aa77aa9d
MD5 9e882cee25139734ab42af2d4449467a
SHA1 760e33b7430468e96f10625b77490bb7e3748ce1
SHA512 101dcf188d1af6ae09b65813b324c011d191b53f7c269e6a6ebc25ce0bf94c50940c905a8ee6e4e0732323fb163de9e94be34a784398a041b3a348bff725a862
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.god.salvation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 9972e351b726fdaed45723e23b52819adb07ab8bc37285a4351cf5a0d126c1ef
MD5 c7a0bc5b6b560251df0f0003ced7b6f4
SHA1 38cfa886f4fc1e6cab7eb2ce86fe84bce694df4c
SHA512 4d4003f3d0177eee67245daf3273d98b534fca9091633cf61b47652b1743495b92f03cfe3c8c1d264c6f5acdb46b773e238e877ae5d82697e91f10c0aebb7b05
SSDEEP 6:7+/l9o74n1Kg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKD:7+tkqLiuWdYRmBEyPbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.god.salvation/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 0d0917d5189fcf81a183b5f85f994abfa194874f0268d0069e401d37f517bf5c
MD5 122e8688275756e6824b83759e6a36d0
SHA1 c0a1ca4d81730ab72e50049add3a02ef925f8a34
SHA512 083831708d9040414134af25e09a0f71544046291888a1763e7975c8c38209efab6c2f64e78b810c3b1ee1158c646c37aa3efcb04d27daada0f378f0b5d04cbe
SSDEEP 6:7+/l9lO4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKk/Ga6:7+tXlqLJdeWRmBEyPbzo
MD5 SHA1 SHA512 SSDEEP

Submit Download

PersistedInstallation366560561950094937tmp

Path /data/data/com.god.salvation/files/PersistedInstallation366560561950094937tmp
Size 90B
SHA256 2925cf0d9b2032f7e5eac6b994fd06d92ea9197dea50240633af31271d3c6562
MD5 d5443ac2e2a258b0abbba5332c411ce4
SHA1 4ab5833a2eca3a7d9ef6f9eed80319806ef33283
SHA512 dd7ddc7ff7931ab1877357a001fd47ef2c15339fe23dad25f298c722c416e1de05210889fafc77ceaf6cbbbf11046902a400bb1d3fe60508cc1f2861cf75b5ba
MD5 SHA1 SHA512

Submit Download

PersistedInstallation5525233365513238720tmp

Path /data/data/com.god.salvation/files/PersistedInstallation5525233365513238720tmp
Size 567B
SHA256 706ce745b7291c85cc3977336a26298a9a5eb784cf57ec72bc3a1bb7868e881a
MD5 7bbb347f723c547fc89987a22da1d586
SHA1 bc3d3ceb0e7a21373a11c7f01c106095d649f4ef
SHA512 9eec374da224f0e2c9ea6ee6e3cfe1e1ca58b10359f9b793e71e735cdcd2adb962ebc89fa49a831782f69a9dd6f93744823d9bf4a85191a37342df36a3737566
MD5 SHA1 SHA512

Submit Download

profileinstaller_profileWrittenFor_lastUpdateTime.dat

Path /data/data/com.god.salvation/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat
Size 8B
SHA256 7c0c57d5837ba481237f9fb2a54a633d3043fbc21dc54efdbc5462973405af9e
MD5 b9c91739dffdac3a75ca7b4b653ef50f
SHA1 063dff4fb669e9eb91f52c166dda3b3e0e1362e8
SHA512 829bccf207b5bb946f293f7267bace2bab5b61164889e18d5fcc0f4cc235fcd0fdcaec570353ebdfda898b47ccef6a1aae5bd1a1937db5cf759479b66011fd20
MD5 SHA1 SHA512

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/com.god.salvation/primary.prof
Size 1KB
SHA256 a4a97926574a64ec8f6d955a09963ce152eb200abdbefdbbee1dc8399421dae9
MD5 6ab8b90e2b58c749790ea7009a81c52d
SHA1 a3d9ec0533feb6a8808225d8b47e5b9cb8e08afd
SHA512 c8f65d351d718402cb4939acfeac2ce73f93564e3de7b6bae4d494baf2cf047eb6d6cadc653b636851db4de4d246a64a251f1b4fc0a9a8c92c33c095bf9b115b
MD5 SHA1 SHA512

Submit Download

Domain (deleted)

Path /storage/emulated/0/Android/data/com.god.salvation/files/Domain (deleted)
Size 4B
SHA256 140bedbf9c3f6d56a9846d2ba7088798683f4da0c248231336e6a05679e4fdfe
MD5 334c4a4c42fdb79d7ebc3e73b517e6f8
SHA1 71f8e7976e4cbc4561c9d62fb283e7f788202acb
SHA512 ab93a9e95d70edb06025511cea4e2b8047fb7e1deaf7244fc0d3edf5e7cb57d8fb7b951bdeb3c6b552714878749eb19b9103e64a83635e8885c7d3e1d0fc5649
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads